Malicious Execution of HackTool - Jlaive In-Memory Assembly (via process_creation)

title: Malicious Execution of HackTool - Jlaive In-Memory Assembly (via process_creation)
id: fe7ef3fe-004e-51c4-b847-045db849bdbd
status: stable
description: This rule detects the use of Jlaive to execute assemblies in a copied PowerShell
references:
    - https://attack.mitre.org/techniques/T1059/003/
    - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
    - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive
author: Huntrule Team
date: 2026-04-01
tags:
    - attack.execution
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    parent_selection:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|endswith: '.bat'
    selection1:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'powershell.exe'
            - '.bat.exe'
    selection2:
        Image|endswith: '\xcopy.exe'
        CommandLine|contains|all:
            - 'pwsh.exe'
            - '.bat.exe'
    selection3:
        Image|endswith: '\attrib.exe'
        CommandLine|contains|all:
            - '+s'
            - '+h'
            - '.bat.exe'
    condition: parent_selection and (1 of selection*)
falsepositives:
    - Unknown
level: medium